cvedb.io
CVE-2026-50628
CRITICAL · CVSS 9.8
EPSS exploitation probability: 0%
Published 2026-06-12T10:16:22.710 · Last modified 2026-07-02T12:17:32.183

Summary

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Affected products

apache — cxf

Does this affect you?

Add your gear to cvedb and we'll alert you only when apache ships something exploited.

Check my exposure →

References

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.